Crypto hack losses hit $768M in September, led by $388M Bitget breach, CertiK says
In brief
- PeckShield counted 55 major incidents and $766.5 million stolen in September.
- CertiK recorded 97 incidents and estimated September losses at $768.4 million.
- Bitget's $388 million hack and Liquid Network's $320 million exploit accounted for most losses.
- CertiK's dashboard shows 656 incidents and $2.68 billion in losses so far in 2026.
Two firms, two counts
PeckShield and CertiK didn't land on the same number. PeckShield counted 55 major incidents resulting in $766.5 million in stolen funds, while CertiK recorded 97 incidents and estimated losses at $768.4 million (that's 42 more incidents than PeckShield logged, but the dollar totals are less than $2 million apart). Both firms showed the losses were a significant increase from August.
Two incidents did most of the damage.
Bitget and Liquid Network lead the losses
The month included a $388 million hack of Bitget and a $320 million hack of the Liquid Network. Cointelegraph said both rank among the largest crypto thefts of the year, and together they accounted for most of September's losses.
The Liquid Network figure comes with a caveat. Cointelegraph reported that more than $270 million from that exploit was later returned, but it sourced that only to unnamed reports, and it hasn't been confirmed. The report doesn't name anyone behind either attack.
Smaller hacks filled out the month. Safe Wallet, DCENT and Duelbits lost $7.8 million, $6 million and $5.9 million respectively, according to Cointelegraph.
A $2.68 billion year so far
CertiK framed September as a warning about how fast the picture can change.
“September was a stark reminder of how quickly the threat landscape can shift,” CertiK said in a statement Wednesday.
The firm's security dashboard shows 656 security incidents in 2026, with total losses of $2.68 billion. September's two biggest breaches add up to $708 million on their own, based on the Bitget and Liquid Network figures. It's a big chunk of the year's tally, and it came from just two incidents in a single month.
